opencode-gitlab-plugin 3.1.0 → 3.2.1

package/CHANGELOG.md

@@ -2,6 +2,20 @@
 
 All notable changes to this project will be documented in this file. See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+## [3.2.1](https://gitlab.com/vglafirov/opencode-gitlab-plugin/compare/v3.2.0...v3.2.1) (2026-10-25)
+
+
+### 🐛 Bug Fixes
+
+* **auth:** read GitLab credentials from the OpenCode v2 store ([a039ea3](https://gitlab.com/vglafirov/opencode-gitlab-plugin/commit/a039ea3345db77973791d36f77716b9cd6e7bdc3))
+
+## [3.2.0](https://gitlab.com/vglafirov/opencode-gitlab-plugin/compare/v3.1.0...v3.2.0) (2026-10-25)
+
+
+### ✨ Features
+
+* **notes:** support confidential/internal notes in gitlab_create_note ([90cedca](https://gitlab.com/vglafirov/opencode-gitlab-plugin/commit/90cedcac2ab128a2f2377a2951776e47a0d395ba))
+
 ## [3.1.0](https://gitlab.com/vglafirov/opencode-gitlab-plugin/compare/v3.0.1...v3.1.0) (2026-10-13)
 
 

package/README.md

@@ -477,11 +477,11 @@ The plugin provides **64 tools** organized into the following categories:
 
 ### Notes Tools (3 tools)
 
-| Tool                 | Description                                                                                         |
-| -------------------- | --------------------------------------------------------------------------------------------------- |
-| `gitlab_list_notes`  | List all notes/comments on any resource (MRs, issues, epics, snippets) with cursor-based pagination |
-| `gitlab_get_note`    | Get a single note by ID (issues and epics only)                                                     |
-| `gitlab_create_note` | Add a simple comment to any resource (for thread replies, use `gitlab_create_discussion`)           |
+| Tool                 | Description                                                                                                                                                                                |
+| -------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
+| `gitlab_list_notes`  | List all notes/comments on any resource (MRs, issues, epics, snippets) with cursor-based pagination                                                                                        |
+| `gitlab_get_note`    | Get a single note by ID (issues and epics only)                                                                                                                                            |
+| `gitlab_create_note` | Add a simple comment to any resource (for thread replies, use `gitlab_create_discussion`). Pass `internal: true` to post a confidential/internal note on merge requests, issues, and epics |
 
 ### Audit Event Tools (3 tools)
 
@@ -534,6 +534,15 @@ await plugin.tool.gitlab_create_note.execute({
   body: 'I will start working on this today.',
 });
 
+// Add a confidential/internal note (visible only to project members; merge requests, issues, and epics)
+await plugin.tool.gitlab_create_note.execute({
+  resource_type: 'issue',
+  project_id: 'my-group/my-project',
+  iid: issue.iid,
+  body: 'Internal triage note - not visible to the reporter.',
+  internal: true,
+});
+
 // List all issues with specific labels
 const issues = await plugin.tool.gitlab_list_issues.execute({
   project_id: 'my-group/my-project',

package/dist/index.js

@@ -511,9 +511,22 @@ var MergeRequestsClient = class _MergeRequestsClient extends GitLabApiClient {
       requestBody
     );
   }
-  async createMrNote(projectId, mrIid, body, discussionId) {
+  /**
+   * Create a note on a merge request.
+   *
+   * When `discussionId` is set the note is a reply on that discussion thread, which the
+   * GitLab Notes API does not allow to be internal. Passing `internal=true` together with a
+   * `discussionId` therefore throws (fail-closed) rather than silently dropping the
+   * confidentiality flag. Post a standalone internal note (omit `discussionId`) instead.
+   */
+  async createMrNote(projectId, mrIid, body, discussionId, internal) {
     const encodedProject = this.encodeProjectId(projectId);
     if (discussionId) {
+      if (internal) {
+        throw new Error(
+          "internal=true is not supported when replying to a discussion. The GitLab Notes API does not accept an internal flag on discussion replies, so honouring it silently would drop a confidentiality flag. Post a standalone internal note (omit discussionId) instead."
+        );
+      }
       return this.fetch(
         "POST",
         `/projects/${encodedProject}/merge_requests/${mrIid}/discussions/${discussionId}/notes`,
@@ -523,7 +536,7 @@ var MergeRequestsClient = class _MergeRequestsClient extends GitLabApiClient {
     return this.fetch(
       "POST",
       `/projects/${encodedProject}/merge_requests/${mrIid}/notes`,
-      { body }
+      internal ? { body, internal: true } : { body }
     );
   }
   async updateMrNote(projectId, mrIid, noteId, body) {
@@ -989,9 +1002,22 @@ var IssuesClient = class extends GitLabApiClient {
       `/projects/${encodedProject}/issues/${issueIid}/discussions/${discussionId}`
     );
   }
-  async createIssueNote(projectId, issueIid, body, discussionId) {
+  /**
+   * Create a note on an issue.
+   *
+   * When `discussionId` is set the note is a reply on that discussion thread, which the
+   * GitLab Notes API does not allow to be internal. Passing `internal=true` together with a
+   * `discussionId` therefore throws (fail-closed) rather than silently dropping the
+   * confidentiality flag. Post a standalone internal note (omit `discussionId`) instead.
+   */
+  async createIssueNote(projectId, issueIid, body, discussionId, internal) {
     const encodedProject = this.encodeProjectId(projectId);
     if (discussionId) {
+      if (internal) {
+        throw new Error(
+          "internal=true is not supported when replying to a discussion. The GitLab Notes API does not accept an internal flag on discussion replies, so honouring it silently would drop a confidentiality flag. Post a standalone internal note (omit discussionId) instead."
+        );
+      }
       return this.fetch(
         "POST",
         `/projects/${encodedProject}/issues/${issueIid}/discussions/${discussionId}/notes`,
@@ -1001,7 +1027,7 @@ var IssuesClient = class extends GitLabApiClient {
     return this.fetch(
       "POST",
       `/projects/${encodedProject}/issues/${issueIid}/notes`,
-      { body }
+      internal ? { body, internal: true } : { body }
     );
   }
   async resolveIssueDiscussion(projectId, issueIid, discussionId) {
@@ -2332,9 +2358,22 @@ var EpicsClient = class extends GitLabApiClient {
       `/groups/${encodedGroup}/epics/${epicIid}/discussions/${discussionId}`
     );
   }
-  async createEpicNote(groupId, epicIid, body, discussionId) {
+  /**
+   * Create a note on an epic.
+   *
+   * When `discussionId` is set the note is a reply on that discussion thread, which the
+   * GitLab Notes API does not allow to be internal. Passing `internal=true` together with a
+   * `discussionId` therefore throws (fail-closed) rather than silently dropping the
+   * confidentiality flag. Post a standalone internal note (omit `discussionId`) instead.
+   */
+  async createEpicNote(groupId, epicIid, body, discussionId, internal) {
     const encodedGroup = encodeURIComponent(groupId);
     if (discussionId) {
+      if (internal) {
+        throw new Error(
+          "internal=true is not supported when replying to a discussion. The GitLab Notes API does not accept an internal flag on discussion replies, so honouring it silently would drop a confidentiality flag. Post a standalone internal note (omit discussionId) instead."
+        );
+      }
       return this.fetch(
         "POST",
         `/groups/${encodedGroup}/epics/${epicIid}/discussions/${discussionId}/notes`,
@@ -2344,7 +2383,7 @@ var EpicsClient = class extends GitLabApiClient {
     return this.fetch(
       "POST",
       `/groups/${encodedGroup}/epics/${epicIid}/notes`,
-      { body }
+      internal ? { body, internal: true } : { body }
     );
   }
   async getEpicNote(groupId, epicIid, noteId) {
@@ -2780,36 +2819,70 @@ applyMixins(UnifiedGitLabClient, [
 ]);
 
 // src/utils.ts
+var integrationToken;
+function setIntegrationToken(token) {
+  integrationToken = token || void 0;
+}
+function credentialToToken(value) {
+  if (!value || typeof value !== "object") {
+    return void 0;
+  }
+  const credential = value;
+  if (credential["type"] === "oauth") {
+    const access = credential["access"];
+    if (typeof access !== "string" || !access) {
+      return void 0;
+    }
+    return isExpired(credential["expires"]) ? void 0 : access;
+  }
+  if (typeof credential["key"] === "string" && credential["key"]) {
+    return credential["key"];
+  }
+  if (typeof credential["token"] === "string" && credential["token"]) {
+    return credential["token"];
+  }
+  return void 0;
+}
+function isExpired(expires) {
+  return typeof expires === "number" && expires > 0 && expires <= Date.now();
+}
 function readTokenFromAuthStorage() {
   try {
     const authPath = path.join(os.homedir(), ".local", "share", "opencode", "auth.json");
     if (!fs.existsSync(authPath)) {
-      return void 0;
+      return {};
     }
     const authData = JSON.parse(fs.readFileSync(authPath, "utf-8"));
     const gitlabAuth = authData?.gitlab;
     if (!gitlabAuth) {
-      return void 0;
+      return {};
     }
-    if (gitlabAuth.type === "oauth" && gitlabAuth.access) {
-      return gitlabAuth.access;
+    const token = credentialToToken(gitlabAuth);
+    if (token) {
+      return { token };
     }
-    if (gitlabAuth.type === "api" && gitlabAuth.key) {
-      return gitlabAuth.key;
+    if (gitlabAuth.type === "oauth" && isExpired(gitlabAuth.expires)) {
+      return { expired: new Date(gitlabAuth.expires) };
     }
-    return gitlabAuth.token || void 0;
+    return {};
   } catch (error) {
-    return void 0;
+    return {};
   }
 }
 function getGitLabClient() {
-  let token = process.env["GITLAB_TOKEN"];
+  let token = process.env["GITLAB_TOKEN"] || integrationToken;
+  let expired;
   if (!token) {
-    token = readTokenFromAuthStorage();
+    ({ token, expired } = readTokenFromAuthStorage());
   }
   if (!token) {
+    if (expired) {
+      throw new Error(
+        `GitLab OAuth token in ~/.local/share/opencode/auth.json expired on ${expired.toISOString()}. Re-authenticate GitLab in OpenCode or set the GITLAB_TOKEN environment variable.`
+      );
+    }
     throw new Error(
-      "GitLab API token not found. Set GITLAB_TOKEN environment variable or configure it in OpenCode auth storage (~/.local/share/opencode/auth.json)."
+      "GitLab API token not found. Set GITLAB_TOKEN environment variable or connect GitLab in OpenCode."
     );
   }
   const instanceUrl = process.env["GITLAB_INSTANCE_URL"] || "https://gitlab.com";
@@ -4902,9 +4975,14 @@ Creates a standalone comment (not part of a thread).
 For replying to existing discussion threads, use gitlab_create_discussion 
 with discussion_id parameter instead.
 
+Set internal=true to post a confidential/internal note visible only to project members
+(supported for merge requests, issues, and epics; not supported for snippets, where passing
+internal=true raises an error rather than silently posting a public note).
+
 Examples:
 - MR comment: resource_type="merge_request", project_id="group/project", iid=123, body="LGTM!"
 - Issue comment: resource_type="issue", project_id="group/project", iid=456, body="Working on this"
+- Internal issue note: resource_type="issue", project_id="group/project", iid=456, body="Internal only", internal=true
 - Epic comment: resource_type="epic", group_id="my-group", iid=1, body="Planning complete"
 - Snippet comment: resource_type="snippet", project_id="group/project", snippet_id=789, body="Nice code!"`,
     args: {
@@ -4913,27 +4991,53 @@ Examples:
       project_id: z14.string().optional().describe("Project ID or path. Required for merge_request, issue, snippet"),
       group_id: z14.string().optional().describe("Group ID or path. Required for epic"),
       iid: z14.number().optional().describe("Internal ID of the resource (for merge_request, issue, epic)"),
-      snippet_id: z14.number().optional().describe("Snippet ID (required for snippet)")
+      snippet_id: z14.number().optional().describe("Snippet ID (required for snippet)"),
+      internal: z14.boolean().optional().describe(
+        "Post as a confidential/internal note visible only to project members (merge requests, issues, and epics; not supported for snippets, where passing true raises an error). Defaults to false (public note)."
+      )
     },
     execute: async (args, _ctx) => {
       validateNoteParams(args.resource_type, args, { allowedTypes: NOTE_RESOURCE_TYPES });
+      if (args.internal && args.resource_type === "snippet") {
+        throw new Error(
+          `internal=true is not supported for snippet notes. Refusing to post a note that was intended to be confidential as a public note.`
+        );
+      }
       const client = getGitLabClient();
       switch (args.resource_type) {
         case "merge_request":
           return JSON.stringify(
-            await client.createMrNote(args.project_id, args.iid, args.body),
+            await client.createMrNote(
+              args.project_id,
+              args.iid,
+              args.body,
+              void 0,
+              args.internal
+            ),
             null,
             2
           );
         case "issue":
           return JSON.stringify(
-            await client.createIssueNote(args.project_id, args.iid, args.body),
+            await client.createIssueNote(
+              args.project_id,
+              args.iid,
+              args.body,
+              void 0,
+              args.internal
+            ),
             null,
             2
           );
         case "epic":
           return JSON.stringify(
-            await client.createEpicNote(args.group_id, args.iid, args.body),
+            await client.createEpicNote(
+              args.group_id,
+              args.iid,
+              args.body,
+              void 0,
+              args.internal
+            ),
             null,
             2
           );
@@ -6000,6 +6104,7 @@ function adaptTool(name, definition, options) {
     input: toInputSchema(definition.args),
     async execute(input, context) {
       const parsed = validator.parse(input ?? {});
+      await options.beforeExecute?.(context);
       const legacyContext = toLegacyContext(context, options.directory, options.worktree);
       const result = await definition.execute(
         parsed,
@@ -6015,6 +6120,19 @@ function adaptTools(tools, options) {
 
 // src/v2/plugin.ts
 var PLUGIN_ID = "gitlab";
+var GITLAB_INTEGRATION_ID = "gitlab";
+async function refreshIntegrationToken(ctx) {
+  const integration = ctx.integration;
+  if (!integration?.connection) {
+    return;
+  }
+  try {
+    const connection = await integration.connection.active(GITLAB_INTEGRATION_ID);
+    const resolved = connection ? await integration.connection.resolve(connection) : void 0;
+    setIntegrationToken(credentialToToken(resolved));
+  } catch {
+  }
+}
 var LAZY_MCP_HINT = `## GitLab Tools via lazy-mcp
 GitLab API tools (MRs, issues, pipelines, security, search, repos, users, todos, work items, discussions, notes, audit, git, award emoji) are served via the "gitlab" MCP server through lazy-mcp. Use lazy-mcp_list_commands with server "gitlab" to discover and call them.
 DAP tools (agents, flows, memory, skills) are on the "gitlab-dap" server instead.`;
@@ -6029,7 +6147,11 @@ var gitlabPluginV2 = Plugin.define({
     }
     const directory = ctx.location.directory;
     const worktree = ctx.location.project.directory ?? directory;
-    const tools = adaptTools(allTools, { directory, worktree });
+    const tools = adaptTools(allTools, {
+      directory,
+      worktree,
+      beforeExecute: () => refreshIntegrationToken(ctx)
+    });
     await ctx.tool.transform((editor) => {
       for (const definition of tools) {
         editor.add(definition);